Contents of /trunk/cpio/patches/cpio-2.13-revert-CVE-2015-1197-fix.patch
Parent Directory | Revision Log
Revision 3546 -
(show annotations)
(download)
Wed Jul 15 11:17:42 2020 UTC (3 years, 11 months ago) by niro
File size: 2508 byte(s)
Wed Jul 15 11:17:42 2020 UTC (3 years, 11 months ago) by niro
File size: 2508 byte(s)
-fixes shutdown issues with dracut
1 | revert fix for CVE-2015-1197 as it causes shutdown issues |
2 | |
3 | revert suggested as a workaround by upstream: |
4 | https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html |
5 | |
6 | --- b/src/copyin.c |
7 | +++ a/src/copyin.c |
8 | @@ -645,14 +645,13 @@ |
9 | link_name = xstrdup (file_hdr->c_tar_linkname); |
10 | } |
11 | |
12 | - cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false); |
13 | - |
14 | res = UMASKED_SYMLINK (link_name, file_hdr->c_name, |
15 | file_hdr->c_mode); |
16 | if (res < 0 && create_dir_flag) |
17 | { |
18 | create_all_directories (file_hdr->c_name); |
19 | + res = UMASKED_SYMLINK (link_name, file_hdr->c_name, |
20 | + file_hdr->c_mode); |
21 | - res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode); |
22 | } |
23 | if (res < 0) |
24 | { |
25 | --- b/tests/CVE-2015-1197.at |
26 | +++ /dev/null |
27 | @@ -1,43 +0,0 @@ |
28 | -# Process this file with autom4te to create testsuite. -*- Autotest -*- |
29 | -# Copyright (C) 2009-2019 Free Software Foundation, Inc. |
30 | -# |
31 | -# This program is free software; you can redistribute it and/or modify |
32 | -# it under the terms of the GNU General Public License as published by |
33 | -# the Free Software Foundation; either version 3, or (at your option) |
34 | -# any later version. |
35 | -# |
36 | -# This program is distributed in the hope that it will be useful, |
37 | -# but WITHOUT ANY WARRANTY; without even the implied warranty of |
38 | -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
39 | -# GNU General Public License for more details. |
40 | -# |
41 | -# You should have received a copy of the GNU General Public License |
42 | -# along with this program. If not, see <http://www.gnu.org/licenses/>. |
43 | - |
44 | -AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)]) |
45 | -AT_CHECK([ |
46 | -tempdir=$(pwd)/tmp |
47 | -mkdir $tempdir |
48 | -touch $tempdir/file |
49 | -ln -s $tempdir dir |
50 | -AT_DATA([filelist], |
51 | -[dir |
52 | -dir/file |
53 | -]) |
54 | -ln -s /tmp dir |
55 | -touch /tmp/file |
56 | -cpio -o < filelist > test.cpio |
57 | -rm dir /tmp/file |
58 | -cpio --no-absolute-filenames -iv < test.cpio |
59 | -], |
60 | -[2], |
61 | -[], |
62 | -[1 block |
63 | -cpio: Removing leading `/' from hard link targets |
64 | -dir |
65 | -cpio: dir/file: Cannot open: No such file or directory |
66 | -dir/file |
67 | -1 block |
68 | -]) |
69 | -AT_CLEANUP |
70 | - |
71 | --- b/tests/Makefile.am |
72 | +++ a/tests/Makefile.am |
73 | @@ -56,9 +56,8 @@ |
74 | symlink-long.at\ |
75 | symlink-to-stdout.at\ |
76 | version.at\ |
77 | big-block-size.at\ |
78 | - CVE-2015-1197.at\ |
79 | CVE-2019-14866.at |
80 | |
81 | TESTSUITE = $(srcdir)/testsuite |
82 | |
83 | --- b/tests/testsuite.at |
84 | +++ a/tests/testsuite.at |
85 | @@ -43,6 +43,5 @@ |
86 | m4_include([setstat04.at]) |
87 | m4_include([setstat05.at]) |
88 | m4_include([big-block-size.at]) |
89 | |
90 | -m4_include([CVE-2015-1197.at]) |
91 | m4_include([CVE-2019-14866.at]) |